Repository navigation
Add SEGGER RTT debug output support #1837
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: trustzone-emulator-tests | |
| on: | |
| push: | |
| pull_request: | |
| jobs: | |
| trustzone-emulator-tests: | |
| runs-on: ubuntu-latest | |
| container: | |
| image: ghcr.io/wolfssl/wolfboot-ci-m33mu:latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Init submodules | |
| run: | | |
| git config --global --add safe.directory "$GITHUB_WORKSPACE" | |
| git submodule update --init --single-branch | |
| - name: Configure stm32h5 (TZ) and build wolfboot | |
| run: | | |
| cp config/examples/stm32h5-tz.config .config | |
| make wolfboot.bin | |
| - name: Run emu test (stm32h5) | |
| working-directory: test-app/emu-test-apps | |
| run: | | |
| ./test.sh | |
| - name: Clean build tree for PKCS11 test (stm32h5) | |
| run: | | |
| make clean distclean | |
| - name: Configure PKCS11 test (stm32h5) | |
| run: | | |
| cp config/examples/stm32h5-tz.config .config | |
| - name: Build persistent PKCS11 test app (stm32h5) | |
| run: | | |
| make PKCS11_TESTAPP=1 | |
| - name: Prepare PKCS11 persistence directory | |
| run: | | |
| rm -rf /tmp/m33mu-pkcs11-persist | |
| mkdir -p /tmp/m33mu-pkcs11-persist | |
| rm -f /tmp/m33mu-pkcs11-first.log /tmp/m33mu-pkcs11-second.log | |
| - name: Run PKCS11 first boot (stm32h5) | |
| run: | | |
| cd /tmp/m33mu-pkcs11-persist | |
| m33mu "$GITHUB_WORKSPACE/wolfboot.bin" \ | |
| "$GITHUB_WORKSPACE/test-app/image_v1_signed.bin:0x60000" \ | |
| --persist --uart-stdout --timeout 120 --expect-bkpt 0x7d \ | |
| | tee /tmp/m33mu-pkcs11-first.log | |
| - name: Verify PKCS11 first boot (stm32h5) | |
| run: | | |
| grep -q "pkcs11: first boot path, creating persistent objects" /tmp/m33mu-pkcs11-first.log | |
| grep -q "pkcs11: created persistent PKCS11 objects" /tmp/m33mu-pkcs11-first.log | |
| grep -q "pkcs11: success" /tmp/m33mu-pkcs11-first.log | |
| grep -q "\\[BKPT\\] imm=0x7d" /tmp/m33mu-pkcs11-first.log | |
| grep -q "\\[EXPECT BKPT\\] Success" /tmp/m33mu-pkcs11-first.log | |
| - name: Run PKCS11 second boot (stm32h5) | |
| run: | | |
| cd /tmp/m33mu-pkcs11-persist | |
| m33mu "$GITHUB_WORKSPACE/wolfboot.bin" \ | |
| "$GITHUB_WORKSPACE/test-app/image_v1_signed.bin:0x60000" \ | |
| --persist --uart-stdout --timeout 120 --expect-bkpt 0x7f \ | |
| | tee /tmp/m33mu-pkcs11-second.log | |
| - name: Verify PKCS11 second boot (stm32h5) | |
| run: | | |
| grep -q "pkcs11: second boot path, restoring persistent objects" /tmp/m33mu-pkcs11-second.log | |
| grep -q "pkcs11: restored persistent PKCS11 objects" /tmp/m33mu-pkcs11-second.log | |
| grep -q "pkcs11: success" /tmp/m33mu-pkcs11-second.log | |
| grep -q "\\[BKPT\\] imm=0x7f" /tmp/m33mu-pkcs11-second.log | |
| grep -q "\\[EXPECT BKPT\\] Success" /tmp/m33mu-pkcs11-second.log | |
| - name: Clean and build stm32u5 (TZ + wolfcrypt) | |
| run: | | |
| make clean distclean | |
| cp config/examples/stm32u5-wolfcrypt-tz.config .config | |
| make wolfboot.bin | |
| - name: Run emu test (stm32u5) | |
| working-directory: test-app/emu-test-apps | |
| run: | | |
| TARGET=stm32u5 ./test.sh | |
| # NuMaker-M2354 (Cortex-M23). This is the only ARMv8-M Baseline target, | |
| # and the only one whose secure view is the base address with the | |
| # non-secure world aliased at +0x10000000. Both worlds are covered: | |
| # TZEN=0 runs wolfBoot and the app entirely in the secure world, TZEN=1 | |
| # runs a non-secure app that reaches wolfBoot through the secure gateway | |
| # veneers. Requires an m33mu with m2354 support (wolfboot-ci >= 1.19). | |
| - name: Clean and build m2354 (Cortex-M23, secure world only) | |
| run: | | |
| make clean distclean | |
| cp config/examples/m2354.config .config | |
| make wolfboot.bin | |
| - name: Run emu test (m2354, S mode) | |
| working-directory: test-app/emu-test-apps | |
| run: | | |
| TARGET=m2354 ./test.sh | |
| - name: Clean and build m2354 (Cortex-M23, TrustZone) | |
| run: | | |
| make clean distclean | |
| cp config/examples/m2354-tz.config .config | |
| make wolfboot.bin | |
| - name: Run emu test (m2354, NS mode) | |
| working-directory: test-app/emu-test-apps | |
| run: | | |
| TARGET=m2354 ./test.sh | |
| - name: Clean and build stm32l5 (TZ + wolfcrypt) | |
| run: | | |
| make clean distclean | |
| cp config/examples/stm32l5-wolfcrypt-tz.config .config | |
| make wolfboot.bin | |
| - name: Run emu test (stm32l5) | |
| working-directory: test-app/emu-test-apps | |
| run: | | |
| TARGET=stm32l5 ./test.sh | |
| - name: Clean and build test with DICE attestation (stm32h5) | |
| run: | | |
| set -o pipefail | |
| make clean distclean | |
| cp config/examples/stm32h5-tz-psa.config .config | |
| make | |
| m33mu wolfboot.bin test-app/image_v1_signed.bin:0x60000 --uart-stdout --expect-bkpt 0x7f --timeout 600 \ | |
| | tee /tmp/m33mu-dice.log | |
| grep -q "IAT size match: challenge=64 token=" /tmp/m33mu-dice.log | |
| grep -q "PSA boot attestation: success" /tmp/m33mu-dice.log | |
| grep -q "\\[BKPT\\] imm=0x7f" /tmp/m33mu-dice.log | |
| grep -q "\\[EXPECT BKPT\\] Success" /tmp/m33mu-dice.log | |
| - name: Clean and build test with fwTPM (stm32h5) | |
| run: | | |
| make clean distclean | |
| cp config/examples/stm32h5-tz-fwtpm.config .config | |
| make | |
| m33mu wolfboot.bin test-app/image_v1_signed.bin:0x60000 --uart-stdout --expect-bkpt 0x7f --timeout 600 \ | |
| | tee /tmp/m33mu-fwtpm.log | |
| grep -q "fwTPM PCR0 extended:" /tmp/m33mu-fwtpm.log | |
| grep -q "fwTPM unsealed secret: wolfBoot fwTPM PCR secret" /tmp/m33mu-fwtpm.log | |
| grep -q "fwTPM NSC tests passed" /tmp/m33mu-fwtpm.log | |
| grep -q "\\[BKPT\\] imm=0x7f" /tmp/m33mu-fwtpm.log | |
| grep -q "\\[EXPECT BKPT\\] Success" /tmp/m33mu-fwtpm.log | |
| # The wolfHSM STM32H5 TrustZone integration is exercised by the | |
| # nightly cross-repo job in wolfHSM | |
| # (.github/workflows/wolfboot-tz-integration.yml), which builds | |
| # this demo against the latest wolfHSM main and runs it under | |
| # m33mu. It is intentionally not gated on every wolfBoot PR. | |
| - name: Clean and build test with DICE attestation + OTP (stm32h5) | |
| run: | | |
| make clean distclean | |
| cp config/examples/stm32h5-tz-psa-otp.config .config | |
| make | |
| make -C tools/keytools/otp TARGET=stm32h5 otp-keystore-primer.bin otp-keystore-gen | |
| ./tools/keytools/otp/otp-keystore-gen | |
| m33mu tools/keytools/otp/otp-keystore-primer.bin --persist --timeout 10 || true | |
| m33mu wolfboot.bin test-app/image_v1_signed.bin:0x60000 --uart-stdout --expect-bkpt 0x7f --timeout 600 --persist | |
| # LPC55S69 DICE attestation + HW PUF. The first boot enrolls the PUF | |
| # and stores the record (WOLFBOOT_HWPUF_PROVISION=1); the second boot | |
| # must reuse it and report the same UEID. Needs the m33mu lpc55s69 | |
| # PUF/RNG models and --persist (m33mu c2d903e, wolfboot-ci >= 1.28). | |
| # The lpc55s69 HAL needs MCUXpresso SDK headers (fsl_common.h); same | |
| # west-based setup as the lpc55s69 jobs in test-configs.yml. | |
| - name: Checkout CMSIS (lpc55s69) | |
| uses: actions/checkout@main | |
| with: | |
| repository: nxp-mcuxpresso/CMSIS_5 | |
| path: CMSIS_5 | |
| - name: Find the latest MCUXpresso SDK release | |
| id: mcux-release | |
| run: | | |
| tag=$(tools/ci/mcux-sdk-latest-release.sh) | |
| echo "tag=$tag" >> "$GITHUB_OUTPUT" | |
| - name: Setup MCUXpresso SDK (lpc55s69) | |
| shell: bash | |
| run: | | |
| python3 -m venv venv | |
| source venv/bin/activate | |
| pip install west | |
| west init -m https://github.com/nxp-mcuxpresso/mcuxsdk-manifests.git --mr ${{ steps.mcux-release.outputs.tag }} mcuxpresso-sdk | |
| cd mcuxpresso-sdk | |
| sed -i '/se_hostlib\|emwin\|executorch/d' manifests/boards/lpcxpresso55s69.yml | |
| west update_board --set board lpcxpresso55s69 | |
| - name: Build and run DICE attestation + HW PUF across two boots (lpc55s69) | |
| run: | | |
| set -o pipefail | |
| make clean distclean | |
| cp config/examples/lpc55s69-tz-psa.config .config | |
| sed -i 's/^HWPUF?=0/HWPUF?=1/' .config | |
| sed -i 's/^WOLFBOOT_HWPUF_PROVISION?=0/WOLFBOOT_HWPUF_PROVISION?=1/' .config | |
| sed -i 's/^WOLFBOOT_UDS_UID_FALLBACK_FORTEST?=1/WOLFBOOT_UDS_UID_FALLBACK_FORTEST?=0/' .config | |
| grep -q '^HWPUF?=1' .config | |
| grep -q '^WOLFBOOT_HWPUF_PROVISION?=1' .config | |
| grep -q '^WOLFBOOT_UDS_UID_FALLBACK_FORTEST?=0' .config | |
| make MCUXSDK=1 MCUXPRESSO="$GITHUB_WORKSPACE/mcuxpresso-sdk/mcuxsdk" MCUXPRESSO_CMSIS="$GITHUB_WORKSPACE/CMSIS_5/CMSIS" | |
| BOOT_ADDR=$(sed -n 's/^WOLFBOOT_PARTITION_BOOT_ADDRESS?*=//p' .config) | |
| rm -rf /tmp/m33mu-lpc55s69-hwpuf-persist | |
| mkdir -p /tmp/m33mu-lpc55s69-hwpuf-persist | |
| cp wolfboot.bin test-app/image_v1_signed.bin /tmp/m33mu-lpc55s69-hwpuf-persist/ | |
| cd /tmp/m33mu-lpc55s69-hwpuf-persist | |
| for boot in first second; do | |
| m33mu wolfboot.bin image_v1_signed.bin:$BOOT_ADDR --cpu lpc55s69 --persist --uart-stdout --expect-bkpt 0x7f --timeout 300 \ | |
| | tee /tmp/m33mu-lpc55s69-dice-hwpuf-$boot.log | |
| grep -q "Booting version:" /tmp/m33mu-lpc55s69-dice-hwpuf-$boot.log | |
| grep -q "Checking integrity...done" /tmp/m33mu-lpc55s69-dice-hwpuf-$boot.log | |
| grep -q "Verifying signature...done" /tmp/m33mu-lpc55s69-dice-hwpuf-$boot.log | |
| grep -q "attest: token size" /tmp/m33mu-lpc55s69-dice-hwpuf-$boot.log | |
| grep -q "state=0x00" /tmp/m33mu-lpc55s69-dice-hwpuf-$boot.log | |
| grep -q "\\[EXPECT BKPT\\] Success" /tmp/m33mu-lpc55s69-dice-hwpuf-$boot.log | |
| done | |
| # The second boot starts confirmed, so it attested from the stored record | |
| grep -q "boot: ver=0x1 state=0x00" /tmp/m33mu-lpc55s69-dice-hwpuf-second.log | |
| first=$(python3 $GITHUB_WORKSPACE/tools/scripts/eat_ueid.py /tmp/m33mu-lpc55s69-dice-hwpuf-first.log) | |
| second=$(python3 $GITHUB_WORKSPACE/tools/scripts/eat_ueid.py /tmp/m33mu-lpc55s69-dice-hwpuf-second.log) | |
| echo "UEID first boot: $first" | |
| echo "UEID second boot: $second" | |
| test -n "$first" | |
| test "$first" = "$second" | |
| - name: Build and run persistent PKCS11 test (lpc55s69) | |
| run: | | |
| set -o pipefail | |
| make clean distclean | |
| cp config/examples/lpc55s69-tz.config .config | |
| make MCUXSDK=1 MCUXPRESSO="$GITHUB_WORKSPACE/mcuxpresso-sdk/mcuxsdk" MCUXPRESSO_CMSIS="$GITHUB_WORKSPACE/CMSIS_5/CMSIS" PKCS11_TESTAPP=1 | |
| BOOT_ADDR=$(sed -n 's/^WOLFBOOT_PARTITION_BOOT_ADDRESS?*=//p' .config) | |
| m33mu wolfboot.bin test-app/image_v1_signed.bin:$BOOT_ADDR --cpu lpc55s69 --persist --uart-stdout --timeout 300 --expect-bkpt 0x7d \ | |
| | tee /tmp/m33mu-lpc55s69-pkcs11-first.log | |
| grep -q "pkcs11: created persistent PKCS11 objects" /tmp/m33mu-lpc55s69-pkcs11-first.log | |
| grep -q "pkcs11: success" /tmp/m33mu-lpc55s69-pkcs11-first.log | |
| m33mu wolfboot.bin test-app/image_v1_signed.bin:$BOOT_ADDR --cpu lpc55s69 --persist --uart-stdout --timeout 300 --expect-bkpt 0x7f \ | |
| | tee /tmp/m33mu-lpc55s69-pkcs11-second.log | |
| grep -q "pkcs11: restored persistent PKCS11 objects" /tmp/m33mu-lpc55s69-pkcs11-second.log | |
| grep -q "pkcs11: success" /tmp/m33mu-lpc55s69-pkcs11-second.log |